CVE-2024-13153 is a stored cross-site scripting vulnerability in the Unlimited Elements For Elementor WordPress plugin. It arises from improper neutralization of user-supplied input in several widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel), allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page. The vulnerability affects all plugin versions up to 1.5.135. The patch requires manual deletion and reinstallation of the affected widgets because the vulnerable widget code is external to the main plugin code base.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required.

No official patch link is provided. The vendor advisory notes that to remediate the vulnerability, the affected widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel) must be manually deleted and reinstalled, as the vulnerable widget code is not part of the main plugin code base. Users should perform this manual remediation promptly to mitigate the risk. Patch status is not yet confirmed from an official vendor advisory; check the vendor's site for updates.